IP Library › Granted Patent US 12,355,716

Granted Patent B2

US 12,355,716 · App. 18/508,029 · Granted Jul 8, 2025

Detecting malicious email attachments using context-specific feature sets

Inventors: Abhishek Singh (Morgan Hill, CA); Kalpesh Kantilal Mantri (Pune, MA)

Assignee: Cisco Technology, Inc.

H04L51/212 H04L51/08 H04L63/1483

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 12,355,716
App. No.: 18/508,029
Granted: Jul 8, 2025
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

This disclosure describes techniques for an email security system to detect a malicious email and take remedial actions in response to the detected malicious email. The techniques described herein may enable the email security system to detect whether an email is malicious based on whether one or more files attached to the email are malicious. In some cases, the email security system determines whether an email attachment file is malicious based on a set of features that are specific to both a classification of the email (e.g., a semantic classification of the email) and a format of the email attachment file.

Claims (86)

1. A method comprising:

receiving, by a processor, first text data associated with a first email and second text data associated with a second email;

providing, by the processor, the first text data and the second text data to a first model;

receiving, by the processor, a first classification associated with the first email and a second classification associated with the first email from the first model;

determining, by the processor, that the first email includes a first attachment file associated with a first format;

determining, by the processor, that the second email includes a second attachment file associated with the first format;

determining, by the processor, a first feature set associated with the first classification in relation to the first format and a second feature set associated with the second classification in relation to the first format, wherein the first feature set comprises a first feature and the second feature set excludes the first feature;

determining, by the processor, that the first attachment file and the second attachment file both satisfy a rule associated with the first feature;

determining, by the processor, that the first email is malicious and the second email is not malicious;

preventing, by the processor, transmission of the second email to a first destination device; and

enabling, by the processor, transmission of the second email to a second destination device.

2. The method of claim 1 , wherein:

the first format is a text format, and

the first feature set comprises a first feature representing whether a file associated with the first format that is attached to an email associated with the first classification includes at least one of an automated code or an embedded object.

3. The method of claim 1 , wherein:

the first format is a web document format; and

4. The method of claim 1 , wherein;

5. The method of claim 1 , further comprising:

determining, by the processor, that the first email includes a third attachment file associated with a second format;

determining, by the processor, a third feature set associated with the first classification in relation to the second format; and

determining, by the processor, that the first email is malicious based on the first feature set and the third feature set.

6. The method of claim 1 , wherein the first model comprises a Latent Dirichlet Analysis (LDA) model.

7. The method of claim 1 , wherein the first model comprises a transformer-based natural language processing model.

8. The method of claim 1 , further comprising:

extracting, by the processor, first header data from the first email;

determining, by the processor, a header anomaly based on the first header data; and

determining, by the processor, that the first email is malicious based further on the header anomaly.

9. The method of claim 8 , wherein the header anomaly comprises at least one of:

a mismatch between a sender address and a reply-to address,

a sending Internet Protocol (IP) address associated with a malicious domain, or

an invalid date in the first header data.

10. The method of claim 1 , further comprising:

extracting, by the processor, a link from the first email;

accessing, by the processor, content associated with the link;

providing, by the processor, the content to the first model; and

receiving, by the processor, a link classification for the content from the first model, wherein determining that the first email is malicious is further based on the link classification.

11. A system comprising:

one or more processors; and

one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

receiving first text data associated with a first email and second text data associated with a second email;

providing the first text data and the second text data to a first model;

receiving a first classification associated with the first email and a second classification associated with the first email from the first model;

determining that the first email includes a first attachment file associated with a first format;

determining that the second email includes a second attachment file associated with the first format;

determining a first feature set associated with the first classification in relation to the first format and a second feature set associated with the second classification in relation to the first format, wherein the first feature set comprises a first feature and the second feature set excludes the first feature;

determining that the first attachment file and the second attachment file both satisfy a rule associated with the first feature;

determining that the first email is malicious and the second email is not malicious;

preventing transmission of the second email to a first destination device; and

enabling transmission of the second email to a second destination device.

12. The system of claim 11 , wherein:

the first format is a text format, and

13. The system of claim 11 , wherein:

the first format is a web document format; and

14. The system of claim 11 , wherein;

15. The system of claim 11 , the operations further comprising:

determining that the first email includes a third attachment file associated with a second format;

determining a third feature set associated with the first classification in relation to the second format; and

determining that the first email is malicious based on the first feature set and the third feature set.

16. One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising: